diff --git a/examples/files-inspector/src/devframe.ts b/examples/files-inspector/src/devframe.ts
index 2c87066a..bef5eb96 100644
--- a/examples/files-inspector/src/devframe.ts
+++ b/examples/files-inspector/src/devframe.ts
@@ -19,6 +19,9 @@ export default defineDevframe({
     command: 'devframe-files-inspector',
     port: 9876,
     distDir,
+    // Single-user localhost demo — skip the trust handshake so the served
+    // SPA can call RPC without an OTP round-trip.
+    auth: false,
   },
   spa: { loader: 'none' },
   setup(ctx) {
diff --git a/examples/next-runtime-snapshot/scripts/build-spa.mjs b/examples/next-runtime-snapshot/scripts/build-spa.mjs
index 745ca443..4b3d477e 100644
--- a/examples/next-runtime-snapshot/scripts/build-spa.mjs
+++ b/examples/next-runtime-snapshot/scripts/build-spa.mjs
@@ -1,5 +1,25 @@
-import { cpSync, mkdirSync, rmSync } from 'node:fs'
+import { chmodSync, cpSync, mkdirSync, readdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
 
 rmSync('dist/client', { recursive: true, force: true })
 mkdirSync('dist', { recursive: true })
 cpSync('src/client/out', 'dist/client', { recursive: true })
+
+// A built SPA must be readable to be served. Some filesystems (e.g. Docker
+// Desktop's shared mounts) drop the read bits when copying, which yields
+// unservable assets and trips downstream `createBuild` copies. Normalize the
+// tree so directories are traversable and files are world-readable.
+function normalizePermissions(dir) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      chmodSync(path, 0o755)
+      normalizePermissions(path)
+    }
+    else if (entry.isFile()) {
+      chmodSync(path, 0o644)
+    }
+  }
+}
+
+normalizePermissions('dist/client')